Splunk Observability Cloud Certified Metrics User — Question 63

While testing the dynamic removal of credit card numbers, an analyst lands on using the rex command. What mode needs to be set to in order to replace the defined values with X?
| makeresults
| eval ccnumber="511388720478619733"
| rex field=ccnumber mode=??? "s/(\d{4}-){3)/XXXX-XXXX-XXXX-/g"
Please assume that the above rex command is correctly written.

Answer options

• A. sed
• B. replace
• C. mask
• D. substitute

Correct answer: A

Explanation

The correct answer is 'A' because the 'sed' mode in the rex command allows for the substitution of specified patterns with another string, such as replacing digits with 'X'. The other options, while they may seem relevant, do not facilitate the same type of substitution as 'sed' does in this context.